February 3, 2024

Hello all,

Two weeks ago, I wrote that if you can’t immediately mitigate Ivanti VPN vulnerabilities, shut it off. It would appear that I was rather prophetic. More on that momentarily. The Federal Burau of Investigation (FBI) revealed that they are outnumbered 50 to 1 by China’s hacker army, and that much of our OT infrastructure is likely compromised. Thankfully the FBI did reveal some positive news about successes against some of the dirt-bags out there. So, let’s get to the actual news items themselves.

The volume of news and other can appear overwhelming, the best strategy is to read the Notable Callouts below and then skim the full list of linked news item titles that follow for things that pertain to you or your environment or simply interest you, and then selecting them for more information. So, let’s get to it. And don’t forget, our site, https://red-n-security.com also has searchable archives of past newsletters.

Notable Callouts:

• AnyDesk, makers of remote-control software, announced that their production servers were breached, and source code was stolen. Huntress Labs has revealed that AnyDesk’s code-signing certificate was likely also stolen and AnyDesk subsequently had to reset it along with all passwords and access tokens. Monitor for rogue AnyDesk installations in your environments and if you legitimately use AnyDesk, update to version 8.0.8 as soon as possible so that you’re running the new certificate.
• Apple Vision Pro, which became available on Friday, received its first patch for a zero-day vulnerability even before hitting retail shelves. It was for a WebKit flaw, that if exploited could have allowed malicious code to run on the device. If you’ve decided to splurge for this $3500 device, make sure that you apply updates immediately after unboxing it.
• ChatGPT was in the news for leaking passwords from private conversations. OpenAI denies that their product is doing so and asserts that the items seen were due to users’ accounts being taken over and used to power unsanctioned “pool of identities that an external community or proxy server uses to distribute free access.” It sounds plausible, until it doesn’t. We will need to wait and see. Meanwhile, if you don’t want it public, don’t ask an AI about it.
• China has been in the cyber news quite a bit this past week. While there’s plenty of negative which you can read about in the linked articles, there is a positive report among the sea of scary ones. The FBI revealed that they’d disrupted the Chinese Volt Typhoon botnet of compromised EOL Cisco and Netgear routers, effectively killing that particular evil proxy network. Score one of the good guys!
• GitLab released updates for its Community Edition (CE) and Enterprise Edition (EE). The flaws are critical and should be patched immediately.
• Ivanti has had another bad week. I’d recommended unplugging the VPN appliances two weeks ago. This week CISA gave government agencies until Saturday to “disconnect all instances of Ivanti Connect Secure and Ivanti Policy Secure solution products from agency networks”. Additionally, CISA ordered continued monitoring, for all agencies to assume compromise, and to double reset all credentials. Meanwhile, the exploitations continue as public and private sector companies struggle to keep up. More on that in a moment.
• Juniper released “out-of-band updates to address high-severity flaws in SRX Series and EX Series that could be exploited by a threat actor to take control of susceptible systems.” The patches are for the J-Web component which is in all versions of JunoOS. If you cannot immediately apply the update, Juniper does have mitigation guidance available.

In Ransomware, Malware, and Vulnerabilities News:

• Ivanti warrants another mention here as well. There were more vulnerabilities found this week and Ivanti has been reported to be struggling to keep up with plugging the expanding list of holes. CISA reported that attackers are finding ways to bypass the mitigations Ivanti proffered. I’m sure this was a key factor in their “disconnect it order”.
• Interpol shared some good news. In a massive joint operation named “Synergia”, it had taken down a 1,300-server network used for cybercrime such as ransomware, phishing, and malware distribution. 60 law enforcement agencies from 55 countries participated in the coordinated effort which resulted in 70% of the C2 servers being taken down, with 31 people arrested and more arrests on the way. Thank you cyber-warriors!

In Other News Events of Note and Interest:

• Floppy Disks are still a thing in Japan until they can comb through and change all of the assorted laws and regulations that stipulated specific media, namely floppies or CD’s, to be used in official reporting. Do you even have a way to read a floppy anymore?
• Starlink is transmitting 42 million GB of data daily! In a fascinating article you’ll see how they accomplish this with lasers in space, creating a mesh network. Truly amazing!

In Cyber Insurance News:

• Why Businesses Switch Cyber Insurance forty eight percent of those surveyed changed insurance in 2023.

Gone are the good old days of simply using a computer, unless you never connect it to another network, or receive any form of media from someone else, and unless you use your computer from inside a soundproof faraday cage. In this free-wheeling cybercrime age, everything is suspect, and rightly should be. Threat actors can even steal your information by listening to how you type on the keyboard and can read your screen by interpreting electromagnetic signals captured from the air. So, do we give up? Of course, not!. Our digital tools have elevated our livelihoods and global culture to incredible heights that even a few decades ago would have been unimaginable. It is good to note that the hacks mentioned above are currently very sophisticated stuff that require much more resources than that average hacker can muster. That being said, the “everything is suspect” mindset needs to be second nature in our interconnected and interdependent world. Even what you would consider to be trusted sources should be continually vetted. In the famous words of Ronald Regan to Mikhail Gorbachev quoting a Russian proverb, “Doveryai, no proveryai”, trust but verify. Keep the shields up.

Viscount Zebulon Wamboldt Pike
Red-N Weekly Cyber Security News

Headline NEWS

• AnyDesk says hackers breached its production servers, reset passwords
• Threat Advisory: Possible AnyDesk Stolen Code Signing Certificate
• Apple fixes zero-day bug in Apple Vision Pro that ‘may have been exploited’
• ChatGPT is leaking passwords from private conversations of its users
• Exclusive: US disabled Chinese hacking network targeting critical infrastructure, sources say
• Upgrade GitLab – Critical Workspace Creation Flaw Allows File Overwrite
• CISA orders federal agencies to disconnect Ivanti VPN appliances by Saturday 2/3/24
• Juniper Networks Releases Urgent Junos OS Updates for High-Severity Flaws

Ransomware, Malware, and Vulnerabilities News

• Ivanti Struggling to Hit Zero-Day Patch Release Schedule
• After Delays, Ivanti Patches Zero-Days and Confirms New Exploit
• Ivanti Discloses 2 New Zero-Day Flaws, One Under Active Exploitation
• Warning: New Malware Emerges in Attacks Exploiting Ivanti VPN Vulnerabilities
• CISA: Attackers Are Bypassing Ivanti VPN Bug Mitigations
• CISA Warns of Active Exploitation of Critical Flaws in Apple iOS and macOS
• CISA deputy director touts progress, anti-ransomware efforts
• FBI confirms it issued remote kill command to blow out Volt Typhoon’s botnet
• Interpol operation Synergia takes down 1,300 servers used for cybercrime
• China Infiltrates US Critical Infrastructure in Ramp-up to Conflict
• China’s Hackers Outnumber FBI Cyber Agents by 50 to 1: FBI Chief
• FritzFrog botnet exploits Log4Shell, PwnKit vulnerabilities
• 31 People Arrested in Global Cybercrime Crackdown
• US Gov Disrupts SOHO Router Botnet Used by Chinese APT Volt Typhoon
• Is critical infrastructure prepared for OT ransomware?
• Critical vulnerability in Mastodon is pounced upon by fast-acting admins
• Telegram Marketplaces Fuel Phishing Attacks with Easy-to-Use Kits and Malware
• macOS Malware Campaign Showcases Novel Delivery Technique
• State-of-the-Art Redis Malware Bypasses Security Solutions
• A zero-day vulnerability (and PoC) to blind defenses relying on Windows event logs
• LockBit shows no remorse for ransomware attack on children’s hospital
• Russia’s GPS Jamming ‘Testing’ NATO Ahead of Potential War
• Russian top-level internet domain suffers massive outage
• Russian APT28 Hackers Targeting High-Value Orgs with NTLM Relay Attacks
• Researchers remotely exploit devices used to manage safe aircraft landings and takeoffs
• Cloudflare hacked using auth tokens stolen in Okta attack
• Firefox 122 Patches 15 Vulnerabilities
• Akira ransomware gang claims Lush cyber attack
• Higher cyber defenses lead to higher ransoms, study finds
• Ransomware Groups Gain Clout With False Attack Claims
• Ransomware payments drop to record low as victims refuse to pay
• Online ransomware decryptor helps recover partially encrypted files
• Chicago’s Lurie Children’s Hospital ‘cybersecurity matter’ under investigation
• The Ransomware Threat in 2024 is Growing: Report
• Energy giant Schneider Electric hit by Cactus ransomware attack
• New ZLoader Malware Variant Surfaces with 64-bit Windows Compatibility
• Hundreds of network operators’ credentials found circulating in Dark Web
• How a mistakenly published password exposed Mercedes-Benz source code
• Jenkins jitters as 45,000 servers still vulnerable to RCE attacks after patch released
• Experts detailed Microsoft Outlook flaw that can leak NTLM v2 hashed passwords
• How Russian spooks hacked Microsoft, the gap in its “morally indefensible” response
• Ars Technica used in malware campaign with never-before-seen obfuscation
• Hitron DVR Zero-Day Vulnerabilities Exploited by InfectedSlurs Botnet
• Johnson Controls says ransomware attack cost $27 million, data stolen
• Clorox Says Cyberattack Costs Exceed $49 Million
• Microsoft Teams phishing pushes DarkGate malware via group chats
• U.S. Postal Service phishing scams rising after post-holiday lull
• Hackers push USB malware payloads via news, media hosting sites
• Pawn Storm Uses Brute Force and Stealth Against High-Value Targets
• Army cyber officials retaliated against whistleblowing staff
• Exploit released for Android local elevation flaw impacting 7 OEMs
• New Linux glibc flaw lets attackers get root on major distros
• Cybercriminals embrace smarter strategies, less effort
• Top Security Posture Vulnerabilities Revealed
• New York Sues Citibank Over Poor Data Security
• Data leak at fintech giant reveals staff calling clients ‘idiots’
• Fulton County, GA has cyber breach
• Freehold Township district, NJ: All schools and offices closed Monday due to cybersecurity incident
• Interpol’s latest cybercrime intervention dismantles ransomware, banking malware servers
• Microsoft 365 users need to be on their guard — new phishing campaign could cause some serious damage
• Malicious logins from suspicious infrastructure fuel identity-based incidents
• ‘Commando Cat’ Is Second Campaign of the Year Targeting Docker
• Arrests in $400M SIM-Swap Tied to Heist at FTX?
• Man Charged in SIM-Swapping Spree is Key Suspect in Hacker Groups Oktapus, Scattered Spider
• Malicious PyPI Packages Slip WhiteSnake InfoStealer Malware onto Windows Machines
• Massive Trello User Data Leak: Hacker Lists 15 Million Records on a Dark Web Hacking Forum
• FTC orders Blackbaud to boost security after massive data breach
• Europcar denies data breach of 50 million users, says data is fake
• Vulnerabilities in WatchGuard, Panda Security Products Lead to Code Execution
• Albabat, Kasseika, Kuiper: New Ransomware Gangs Rise with Rust and Golang
• Exploits released for critical Jenkins RCE flaw, patch now
• Tor Code Audit Finds 17 Vulnerabilities

Other News Events of Note and Interest

• Cool Tool – Microsoft PC Manager 3.3.13.0
• Cool Tool – LibreOffice 24.2 Open-Source Office Suite Officially Released
• How to Align Your Incident Response Practices With the New SEC Disclosure Rules
• Microsoft, Apple, Mozilla, Google and others join forces to continue making browsers better
• AMD fixes Windows 11 Modern Standby Ryzen wake issue with latest chipset driver
• New Gmail rule kicked in Friday
• The floppy disk refused to die in Japan
• FCC moves to outlaw AI-generated robocalls
• Check if you’re in Google Chrome’s third-party cookie phaseout test
• Google Chrome has a secret switch to speed up your computer
• Google shares fix for Pixel phones hit by bad system update
• Super long-range Wi-Fi works at a range of 1.8 miles
• Killing off Windows 10 could send 240million PCs to landfill
• Apple confirms ongoing outage affecting iCloud Mail and more
• Windows 3.11 lives on as job ad pleads for software support
• Microsoft axes WordPad after 28 years of duty
• Microsoft Teams hit by second outage in three days
• Microsoft Edge is apparently usurping Chrome on people’s PCs
• Microsoft’s new OneDrive design starts rolling out for consumers
• Microsoft says Outlook apps can’t connect to Outlook.com
• Reenroll devices without wipe – Modern Device Management
• ICANN Pushes to Replace the 192.168.x.x Top-Level Domain
• Oracle quietly extends Solaris 11.4 support until 2037
• Starlink’s Laser System Is Beaming 42 Million GB of Data Per Day
• Apple Says ‘Hello’ to Vision Pro in New Ad as Headset Nears Launch
• AI poisoning tool Nightshade received 250,000 downloads in 5 days
• Dell Terminates Agreement With VMware After Broadcom Acquisition
• VMware’s Global CMO Exits As Broadcom Wake Sees Big Exec Departures
• Thunderbird Has a Problem With Outlook, Hotmail, and Live Email Addresses
• After 32 years, one of the ’Net’s oldest software archives is shutting down
• SolarWinds calls SEC charges unfounded and inexplicable, files for dismissal
• UK law could ban Apple security updates across the world in an ‘unprecedented overreach’
• Microsoft, X throw their weight behind KOSA, the controversial kids online safety bill
• The new Outlook for Windows to get drag-and-drop support for downloading attachments and emails
• Scientists use artificial intelligence to achieve the seemingly impossible with hurricane simulations
• Chip smuggling operation that sent 53,000 banned American chips to China gets busted
• Riding the AI Waves: The Rise of Artificial Intelligence to Combat Cyber Threats
• Microsoft Graveyard: a new website for tracking dead and soon-to-be-dead Microsoft products
• ‘Apple’s new policy is a step in the wrong direction.’ Microsoft, Spotify, decry Apple’s ‘compliance’ with new European app store rules

Cyber Insurance News

• What trends are driving cyber risk for North American companies?
• WTW launches tailored cyber insurance solution for small and medium-sized enterprises (SME)
• Why businesses switch their cyber insurance provider
• Have you been a victim of a cyber threat? Explore these five roles of cyber insurance in a hyperconnected world